Cybersecurity
On February 24, Russia invaded Ukraine. In the months to come, Americans will see shocking images and read about horrible events of this conflict. When a country has sanctions placed against it, the threat increases for that country to go after the nation that placed sanctions against it. The Russia-Ukraine War is just one more reason why companies and individuals should also be extra diligent in protecting their information. Hackers are watching and waiting for opportunities to connect and take a company’s data, then demand ransom.
Hacking Reflex
Jeff Lanza spent 20 years with the FBI fighting cybercrime. Now he runs The Lanza Group, a cybersecurity firm based in Kansas City, Mo. Lanza is an authority on cyberattacks, identity theft protection, and keeping children safe online. “It depends on the attack,” Lanza says of which industry hackers are more likely to target. “They target specific industries based on who they think is apt to pay.”
Ransomware is used by hackers to hold a company’s business hostage until payment is received. “These types of companies are more likely to pay, so they are targeted for that reason,” Lanza says. The three types of ransomware are as follows:
Ransomware. A company’s files are locked on company computers, and an electronic key is needed from the hackers to unlock and decrypt files. Malware is used to encrypt the files and make them inaccessible to a company. A ransom is demanded for the electronic key.
Cyber blackmail. Hackers steal company files containing customer information from a database and threaten to release the information if the company does not pay a ransom.
Proprietary blackmail. Hackers gain intellectual property such as business documents that a company would not want a competitor to have access to, and the hackers threaten to release the information unless paid ransom.
Another form of hacking, Lanza says, involves the actual theft of money from a company. Hackers can steal by:
• Intercepting communication of wire transfers; or by
• Gaining bank information, which can include employee banking information. “That can be very serious,” Lanza says. The theft of employee banking information also encourages identity theft. “These are the main two that we see today.”
Josh Schwermer, chief technology officer for Omega Glass LLC in Suffolk City, Utah, says medium and small auto glass companies should be on the lookout for Ransomware and data breaches. “The best antidote against [Ransomware] is to make sure you have back-ups [off-site],” he says. He encourages periodic testing to ensure a company can restore data.
Schwermer also warns against the sharing of passwords among individuals or across systems to prevent data breaches. “The general advice against any cyberattack is to practice cyber hygiene.”
Hacking Prevention
NOVUS Glass’s vice president of operations Ted Andersen his the company
maintains a protocol of steps to prevent cyberattacks. “That’s a main concern
of our organization,” he says. With a worldwide franchise network, if any part of the company were breached, the rest of the company would be vulnerable to a cybercrime. “We take it very, very seriously,” Andersen says.
Andersen says NOVUS deploys first-notice of loss for insurance companies in Canada, and protocols are in place to protect customer information. “The Mygrant thing put it front and center for us,” he says. Mygrant Glass’s inventory and ordering systems were disabled through hacking in January, Paul Anaya, Mygrant’s vice president of sales and marketing told glassBYTEs.com, and the company’s website and ordering systems were down for weeks. For more than 10 years, Andersen says NOVUS has maintained protocols and a back-up off-site to prevent a cyberattack, but the company remains aware that if it can happen to Mygrant, it can happen to anyone.
NOVUS operates Fix Network in Canada. “Since 2020, Fix Network has made significant investments in information security by recruiting dedicated and experienced professionals, consolidating and securing its core systems and deploying industry-leading Information security tools and processes to increase and ensure the network’s overall Information Security posture,” says Yves Beland, NOVUS director of IT operations and information security.
Schwermer says that auto glass companies should check insurance policies for cyber-liability, which could be a financial advantage for a small- or medium-sized company in the event of a cyberattack. “You have someone you can call to get the ball rolling,” he says. Insurance also helps in the logistics of responding to an attack. “For better or worse, I think auto glass has always been behind on technology while other industries are ahead. Unfortunately, now it’s starting to invade our space,” Schwermer says.
Lanza recommends three ways to prevent hacking.
• Employee training and lots of it. Employees should be trained on how to spot a malicious email.
• A back-up plan. If hacked, a company’s files should be maintained in another location so that they can be recovered quickly and the company get back to business.
• An alert system. Key members of the company should be notified when money is transferred from a particular account. “The faster you know about things, the better off you’ll be in terms of resolving them,” Lanza says.
“Because hackers, wherever they live, have the ability to affect our computers in the U.S., one method of retaliation for sanctions in a country is to attack another country [through computers],” Lanza says. The cyberattacks could be state-sanctioned or could be the work of individuals. “We are woefully behind in terms of our cybersecurity in the U.S.,” he says. Biden addressed this in the Infrastructure Investment and Jobs Act 2021. “The Russians know that as well as other countries,” Lanza says.
“I think any company needs to be more careful about how they train their employees,” Lanza says of what companies can do to prepare after the sanctions are enacted. The most common way hackers get to companies is through emails with malware.
Steps to Protect Your Company from Cyberattack
● Maintain backup of data off-site.
● Protect company information on outside sources.
● Make sure your company is not using any Russian-developed software. If it is, enlist a third party to perform a comprehensive code review.
● When it comes to IT security, allow access to individuals on an as-needed basis. Disable accounts no longer in use. Require multifactor authentication wherever possible.
● Have a cybersecurity incident preparedness and response plan for employees.
● The number one cyberattack maneuver is phishing. Train employees on spotting a suspicious email, and not clicking on attachments or links in emails from unknown sources.
Rebecca Barnabi is special projects manager for AGRR magazine. Connect with her on LinkedIn or email her at rbarnabi@glass.com.
To view the laid-in version of this article in our digital edition, CLICK HERE.
